aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv6
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2015-04-03 21:09:51 -0400
committerDavid S. Miller <davem@davemloft.net>2015-04-04 12:52:06 -0400
commit8f8a37152df49d541c43f010543f2b0176fcfb8e (patch)
tree31c7e2443db22aefedeed39dfe36093527b688be /net/ipv6
parent8fe22382d1e73dc0ded8098ccf761c986149f72b (diff)
netfilter: Pass nf_hook_state through ip6t_do_table().
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
-rw-r--r--net/ipv6/netfilter/ip6_tables.c13
-rw-r--r--net/ipv6/netfilter/ip6table_filter.c3
-rw-r--r--net/ipv6/netfilter/ip6table_mangle.c12
-rw-r--r--net/ipv6/netfilter/ip6table_nat.c3
-rw-r--r--net/ipv6/netfilter/ip6table_raw.c3
-rw-r--r--net/ipv6/netfilter/ip6table_security.c2
6 files changed, 16 insertions, 20 deletions
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 83f59dc3cccc..1a732a1d3c8e 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -317,8 +317,7 @@ ip6t_next_entry(const struct ip6t_entry *entry)
317unsigned int 317unsigned int
318ip6t_do_table(struct sk_buff *skb, 318ip6t_do_table(struct sk_buff *skb,
319 unsigned int hook, 319 unsigned int hook,
320 const struct net_device *in, 320 const struct nf_hook_state *state,
321 const struct net_device *out,
322 struct xt_table *table) 321 struct xt_table *table)
323{ 322{
324 static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long)))); 323 static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
@@ -333,8 +332,8 @@ ip6t_do_table(struct sk_buff *skb,
333 unsigned int addend; 332 unsigned int addend;
334 333
335 /* Initialization */ 334 /* Initialization */
336 indev = in ? in->name : nulldevname; 335 indev = state->in ? state->in->name : nulldevname;
337 outdev = out ? out->name : nulldevname; 336 outdev = state->out ? state->out->name : nulldevname;
338 /* We handle fragments by dealing with the first fragment as 337 /* We handle fragments by dealing with the first fragment as
339 * if it was a normal packet. All other fragments are treated 338 * if it was a normal packet. All other fragments are treated
340 * normally, except that they will NEVER match rules that ask 339 * normally, except that they will NEVER match rules that ask
@@ -342,8 +341,8 @@ ip6t_do_table(struct sk_buff *skb,
342 * rule is also a fragment-specific rule, non-fragments won't 341 * rule is also a fragment-specific rule, non-fragments won't
343 * match it. */ 342 * match it. */
344 acpar.hotdrop = false; 343 acpar.hotdrop = false;
345 acpar.in = in; 344 acpar.in = state->in;
346 acpar.out = out; 345 acpar.out = state->out;
347 acpar.family = NFPROTO_IPV6; 346 acpar.family = NFPROTO_IPV6;
348 acpar.hooknum = hook; 347 acpar.hooknum = hook;
349 348
@@ -393,7 +392,7 @@ ip6t_do_table(struct sk_buff *skb,
393#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) 392#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
394 /* The packet is traced: log it */ 393 /* The packet is traced: log it */
395 if (unlikely(skb->nf_trace)) 394 if (unlikely(skb->nf_trace))
396 trace_packet(skb, hook, in, out, 395 trace_packet(skb, hook, state->in, state->out,
397 table->name, private, e); 396 table->name, private, e);
398#endif 397#endif
399 /* Standard target? */ 398 /* Standard target? */
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index eb9ef093454f..5c33d8abc077 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -37,8 +37,7 @@ ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
37{ 37{
38 const struct net *net = dev_net(state->in ? state->in : state->out); 38 const struct net *net = dev_net(state->in ? state->in : state->out);
39 39
40 return ip6t_do_table(skb, ops->hooknum, state->in, state->out, 40 return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_filter);
41 net->ipv6.ip6table_filter);
42} 41}
43 42
44static struct nf_hook_ops *filter_ops __read_mostly; 43static struct nf_hook_ops *filter_ops __read_mostly;
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index e713b8d3dbbc..b551f5b79fe2 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -32,7 +32,7 @@ static const struct xt_table packet_mangler = {
32}; 32};
33 33
34static unsigned int 34static unsigned int
35ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out) 35ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
36{ 36{
37 unsigned int ret; 37 unsigned int ret;
38 struct in6_addr saddr, daddr; 38 struct in6_addr saddr, daddr;
@@ -57,8 +57,8 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
57 /* flowlabel and prio (includes version, which shouldn't change either */ 57 /* flowlabel and prio (includes version, which shouldn't change either */
58 flowlabel = *((u_int32_t *)ipv6_hdr(skb)); 58 flowlabel = *((u_int32_t *)ipv6_hdr(skb));
59 59
60 ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, NULL, out, 60 ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, state,
61 dev_net(out)->ipv6.ip6table_mangle); 61 dev_net(state->out)->ipv6.ip6table_mangle);
62 62
63 if (ret != NF_DROP && ret != NF_STOLEN && 63 if (ret != NF_DROP && ret != NF_STOLEN &&
64 (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) || 64 (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) ||
@@ -80,12 +80,12 @@ ip6table_mangle_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
80 const struct nf_hook_state *state) 80 const struct nf_hook_state *state)
81{ 81{
82 if (ops->hooknum == NF_INET_LOCAL_OUT) 82 if (ops->hooknum == NF_INET_LOCAL_OUT)
83 return ip6t_mangle_out(skb, state->out); 83 return ip6t_mangle_out(skb, state);
84 if (ops->hooknum == NF_INET_POST_ROUTING) 84 if (ops->hooknum == NF_INET_POST_ROUTING)
85 return ip6t_do_table(skb, ops->hooknum, state->in, state->out, 85 return ip6t_do_table(skb, ops->hooknum, state,
86 dev_net(state->out)->ipv6.ip6table_mangle); 86 dev_net(state->out)->ipv6.ip6table_mangle);
87 /* INPUT/FORWARD */ 87 /* INPUT/FORWARD */
88 return ip6t_do_table(skb, ops->hooknum, state->in, state->out, 88 return ip6t_do_table(skb, ops->hooknum, state,
89 dev_net(state->in)->ipv6.ip6table_mangle); 89 dev_net(state->in)->ipv6.ip6table_mangle);
90} 90}
91 91
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index d78f69c7abce..c3a7f7af0ed4 100644
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -37,8 +37,7 @@ static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,
37{ 37{
38 struct net *net = nf_ct_net(ct); 38 struct net *net = nf_ct_net(ct);
39 39
40 return ip6t_do_table(skb, ops->hooknum, state->in, state->out, 40 return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_nat);
41 net->ipv6.ip6table_nat);
42} 41}
43 42
44static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops, 43static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops,
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 937908e25862..0b33caad2b69 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -24,8 +24,7 @@ ip6table_raw_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
24{ 24{
25 const struct net *net = dev_net(state->in ? state->in : state->out); 25 const struct net *net = dev_net(state->in ? state->in : state->out);
26 26
27 return ip6t_do_table(skb, ops->hooknum, state->in, state->out, 27 return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_raw);
28 net->ipv6.ip6table_raw);
29} 28}
30 29
31static struct nf_hook_ops *rawtable_ops __read_mostly; 30static struct nf_hook_ops *rawtable_ops __read_mostly;
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index f33b41e8e294..fcef83c25f7b 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -41,7 +41,7 @@ ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
41{ 41{
42 const struct net *net = dev_net(state->in ? state->in : state->out); 42 const struct net *net = dev_net(state->in ? state->in : state->out);
43 43
44 return ip6t_do_table(skb, ops->hooknum, state->in, state->out, 44 return ip6t_do_table(skb, ops->hooknum, state,
45 net->ipv6.ip6table_security); 45 net->ipv6.ip6table_security);
46} 46}
47 47